Privacy Policy

Effective date: October 21, 2026 Operator: Veilo Contact: support@veiloapp.com

1. Scope

Veilo is responsible for the personal information described in this Policy. This Policy covers the Veilo app, our support and policy website, and communications with support. It explains the difference between your on-device collection and information processed by our online services.

2. Your on-device collection

Cabinets, item photos, cutouts, standees, labels, notes, dates, People names and city/country labels are stored on your device. Cabinet photo cutouts are processed on the device. The cabinet feature does not upload or synchronize this collection to our servers. Profile-avatar uploads and content you submit to online features are separate and are described below.

Veilo stores a compressed copy of an item's original photo for later editing and export. For group photos, that original can contain people you did not select. Please consider their privacy before keeping or sharing it. Cutouts do not create a face-recognition identity database.

When you choose a photo or use location-assisted labeling, photo metadata or the device's coordinates may be processed locally to suggest a date and city/country. The collection's place label stores the city and country, rather than a precise coordinate. This does not mean that a photo you select is free of embedded metadata.

Your device's own backup settings may allow Apple or another service you choose to back up app data. Such backups are controlled by that service and your settings, rather than a Veilo collection-sync feature.

3. Account and service information

Account and profile: we process your email and sign-in information, or your Sign in with Apple identifier and information Apple makes available with your authorization. For email sign-in, the app sends the password you enter to the authentication service. We also process your account ID, session credentials, nickname, birthday, gender and avatar when you provide them. A profile avatar is uploaded to server-designated storage; it is not part of the local-only cabinet collection.

Device and connection: requests to our services include a device identifier, app and build version, operating-system version, device model, time-zone information and request identifiers. Our services and hosting providers receive connection information such as your IP address and request times. Where configured, requests can also include a push token, an Adjust identifier and attribution information.

Online content: the app can show online services in an embedded browser. These services may receive account/session information and device information needed to operate the feature. If you choose a photo or video for an online feature, that media can be uploaded and its URL returned to the page. If an online feature requests location and you grant the system permission, precise latitude and longitude can be passed to that feature. Online pages may also use cookies or similar browser storage. Review the notices shown by the feature and any third-party provider before submitting information or making a payment.

Support: if you email us, we receive your email address, message and any attachments you choose to send. Please do not send passwords, sign-in tokens, full payment-card details or private collection exports unless necessary for a specific issue.

4. Notifications, analytics and attribution

When configured, Veilo uses Apple Push Notification service and Google Firebase Cloud Messaging to deliver notifications. This involves device registration tokens and notification payloads. You can change notification permission in iOS Settings.

Builds with Firebase configured may use Google Firebase Analytics for automatic app-usage and diagnostic measurement. When configured, Adjust provides install/campaign attribution and Meta (Facebook App Events) records automatic app events. These services may process app interactions, device/app identifiers, IP-derived information and attribution information. SDKs whose required configuration is absent are not started.

We request App Tracking Transparency permission for tracking that requires it on iOS. Meta advertiser-tracking settings follow that permission. You can change your choice in iOS Settings > Privacy & Security > Tracking. Refusing tracking permission does not prevent use of cabinet features; it does not necessarily stop all operational analytics or non-tracking measurement.

Provider notices: Apple (https://www.apple.com/legal/privacy/), Google/Firebase (https://firebase.google.com/support/privacy), Adjust (https://www.adjust.com/terms/privacy-policy/) and Meta (https://www.facebook.com/privacy/policy/).

5. Why information is used

We use information to authenticate accounts, save and display profiles, provide requested online features and notifications, respond to support, maintain security, troubleshoot service problems, measure usage and campaign performance, and meet legal obligations. We do not use your local cabinet photos or People names for advertising.

Where a legal basis is required, processing relies on providing the service you request, consent for permissions or tracking where required, legal obligations, or legitimate interests in service security, support and improvement where those interests are not overridden by your rights. You may withdraw consent through the relevant settings or by contacting us; withdrawal does not undo earlier lawful processing.

6. Sharing and international processing

Information is shared with providers that help us operate authentication, hosting, media storage, email/support, notifications, analytics and attribution, to the extent needed for those functions. The policy/support website is hosted by Cloudflare, which processes request information to deliver and protect the site. The website does not include advertising or analytics scripts added by Veilo. Cloudflare's privacy notice is at https://www.cloudflare.com/privacypolicy/.

We may disclose information when legally required, to address fraud or security threats, to protect rights, or as part of a business transfer subject to applicable privacy protections. When you export or share content, the recipients and services you choose receive that content. Payment providers receive the information you submit to their checkout and handle it under their own notices.

Providers may process information outside your country. Where applicable law requires transfer safeguards, we will use the required safeguards. Contact support@veiloapp.com with questions about international processing or the safeguards applicable to your information.

7. Retention, exports and deletion

Local collection data remains on the device until you remove it, delete the app, or successfully delete that account in the app. Signing out alone does not remove the collection. Device backups and copies on other devices may remain under their own settings.

Me > Backup > Export ZIP creates an unencrypted archive of collection data and media, including stored original photos and people you did not select in group photos. Keep it secure. There is currently no import or restore feature. Deleting content or an account does not recall exports, shared copies or saved photo-library images.

Server-side account information is retained while needed to provide your account and requested services. Open Me > Delete Account and complete both confirmations to request account deletion. After server confirmation, Veilo removes the account's local collection from that device. If you cannot access the app, email support@veiloapp.com to request assistance; we may need to verify ownership.

Information retained after a deletion request is limited to what is necessary for legal obligations, security, fraud prevention or resolving disputes, and is kept only as long as that purpose requires. Backup copies, where held by service providers, are removed or overwritten under the relevant backup lifecycle. Contact us for the retention details applicable to your request. Support correspondence is kept as needed to resolve the issue and handle related obligations.

8. Your choices and rights

You can edit your profile in Me, delete collection items, export your collection, and request account deletion. Camera, photo-library, location, notification and tracking permissions can be reviewed in iOS Settings or Me > Permissions where available. Denying a permission may limit the feature that needs it. Information already submitted to online services is not automatically recalled when you revoke a device permission.

Depending on your location, you may have rights to access, correct, delete or receive a copy of personal information, restrict or object to processing, withdraw consent, and complain to your local data-protection authority. Contact support@veiloapp.com to exercise these rights, including any applicable rights concerning sale, sharing or targeted advertising. We may verify your identity and will respond as required by applicable law. We will not discriminate against you for exercising a privacy right.

9. Security and age

We use technical and organizational measures intended to protect personal information, but no device, transmission or storage system is completely secure. Protect your device, credentials and exported files. Send security concerns to support@veiloapp.com.

Veilo is intended for adults aged 18 or older. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

10. Changes and contact

Updates will be published with a revised effective date in the app and on our website. We will provide further notice or request consent where required. For privacy questions or requests, contact Veilo at support@veiloapp.com.